Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ UDemy > Section 26 - Public Key Infrastructure > Flashcards

Section 26 - Public Key Infrastructure Flashcards

1
Q

What is PKI?

A

Public Key Infrastructure

An entire system of hardware, software, policies, procedures, and people that is based on asymmetric encryption.

*** This is the system that creates the asymmetric key pairs that consist of those public and private keys that are used in encryption and decryption. As well as managing those key pairs to make sure that they’re valid and can be trusted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the difference between PKC, PKE and PKI?

A

PKC (Public Key Cryptography) is just talking about the encryption and decryption process. It is a small part of the overall PKI (Public Key Infrastructure) architecture.

PKE (Public Key Encryption) is just the asymmetric encryption and decryption piece.

PKI is the system that creates the asymmetric key pairs

Remember that PKI uses PKC to do its function but PKI is the entire system of things that are done to be able to create the secure connection from end to end

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

For PKI to work successfully, we need to have a trusted third party involved. This is known as…?

A

A certificate authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What do certificate authorities do?

A

They are going to issue digital certificates and are going to keep the level of trust between all of the certificate authorities around the world

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a digital certificate?

A

A certificate is a digitally signed electronic document that binds a public key with a user’s identity

*** The user in this case can be a human or a server, work station or device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Certificates commonly use the ____ standard for digital certificates.

A

X.509

*** This contains the owner’s or user’s information like their name, organization, certificate authority information and their public key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

To get a digital certificate for your web server, you have to purchase that certificate from…?

A

A certificate authority or a registration authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

When a certificate is purchased for a server, it’s only applied to…?

A

one server by default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a wildcard certificate?

A

Allows all of the subdomains to use the same public key certificate and have it displayed as valid

*** A bypass for a certificate typically only allows one certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the SAN field?

A

Subject Alternate Name

This field in a certificate specifies what additional domains and IP addresses are going to be supported by that certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a single sided certificate?

A

Only one side of this authentication is happening with the certificate

*** When you connect to a website, there’s a secure session that’s established and the server is going to identify itself to your web browser using the server’s digital certificate. You are not required to have your own certificate to be authenticated back to the server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a dual-sided certificate?

A

When an organization requires both the server and the user to validate each other using certificates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

With digital certificates, each certificate is validated using the concept of…?

A

Chain of Trust

Moving from the bottom upward

** Think of this like a family tree. Your child would have to go up the family tree through the Chain of trust to get approved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Digital certificates are usually based on the X.509 standard but the certificate itself must be ___ before it can be used.

A

encoded

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the three different encoding methods under the X.690 standard?

A

BER
CER
DER

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is BER?

A

Basic Encoding Rules

The original rule set governing the encoding of data structures for certificates

*** BER has the ability to have multiple encoding types which makes it different from CER

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is CER?

A

Canonical Encoding Rules

The restricted version of BER that only allows the use of one encoding type

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is DER?

A

Distinguished Encoding Rules

Another restricted version of BER that only allows one encoding type as well but it has more restrictive rules for length, character strings and how a particular element or digital certificate is stored.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What encoding type is most commonly used for X.509 certificates?

A

DER

20
Q

When dealing with digital certificates you may come across a few different file types on your machine, including…?

A

PEM
CER
CRT
KEY
P12
PFX
P7B

21
Q

The .pem format is used for…?

A

Privacy Enhanced Electronic Mail

Uses the DER encoding method

Sometimes is stored as a .cer, .crt, or .key file

22
Q

The .p12 file is going to be used for…?

A

To store a server certificate, an intermediate certificate, and a private key in one encrypted file

This is called .p12 because it’s a binary format of the PKC system #12 certificate

23
Q

The .pfx file is used for…?

A

Personal Information Exchange

This is used by Microsoft for release signing. This file is going to contain both private and public keys in it.

24
Q

The .p7b file is used for…?

A

Used as the basis for S/MIME, the secure email protocol. It is also used for single sign-on.

It is called .p7b because it’s based on the PKCS#7.

25
Q

What is X.509?

A

Standard used for PKI for digital certificates and contains the owners/users information and the certificate authority’s information

26
Q

For a digital certificate to be issued, a user first has to request a digital certificate from…?

A

Registration Authority (RA)

27
Q

The RA requests the identifying information from the user and forwards that certificate request up to the…?

A

Certificate Authority (CA)

28
Q

The ___ ___ creates the digital certificate, including the user’s public key and their identity information, and passes that back to the user.

A

CA

29
Q

There are many root certificate authorities out there including companies like…?

A

Verisign, Digisign and many others

30
Q

The root certificate authorities act as a trusted ___ ___ to validate the certificates are being issued to the correct people.

A

Third party

*** In addition, they also maintain a publicly-accessible copy of that user’s public key and this allows them to have that for use by other users who wish to send them confidential information.

31
Q

What is CRL?

A

Certificate Revocation List

An online list of digital certificates that the certificate authority has already revoked

This is a list of every certificate EVER revoked.

*** This is usually because the certificate has been compromised.

32
Q

If you want to determine if a certificate was revoked, you would have to use a protocol known as…?

A

OSCP

Online Certificate Status Protocol

Using its serial number you can determine the revocation status of any digital certificate

This is a status of certificates that provides validity such as good, revoked or unknown.

*** This is an alternative to the CRL

33
Q

What is the difference between OSCP and CRL?

A

OSCP operates much more quickly and efficiently because it doesn’t use encryption but that also makes it less secure than CRL.

34
Q

OSCP is an alternative to CRL. What is the alternative to OSCP?

A

OSCP Stapling

Allows the certificate holder to get the OSCP record from the server at a regular interval and include it as part of the SLL or TLS handshake.

This eliminates an additional connection being required at the time of the user’s request and speeds up the secure tunnel creation process.

*** This used to be known as the TLS Certificate Status Request Extension

35
Q

What is a concern with digital certificates?

A

If an attacker impersonates a server

36
Q

What is public key pinning?

A

Allows an HTTPS website to resist impersonation attacks from those who are trying to present fraudulent certificates by presenting a set of trusted public keys to the user’s web browser as part of its HTTP header.

37
Q

What is “Key Escrow”?

A

Occurs when a secure copy of a user’s private key is held just in case that user accidentally loses their key

They essentially store the keys

*** Remember to protect someone from trying to steal those keys you should always have two different administrators be present when a key is being taken out of escrow. This implements the concept of “separation of duties.”

38
Q

What is “Key Recovery Agent”?

A

A specialized type of software that allows the restoration of a lost or corrupted key to be performed

*** This of it as a backup for all of the certificate authority’s keys in the event of an accident or disaster were to occur.

39
Q

Remember - If a root CA is compromised by an attacker then, every certificate that has been issued by that CA is now considered…?

A

Compromised

They have to be revoked and reissued.

40
Q

What is the “Web of Trust”?

A

A decentralized trust model that addresses issues associated with the public authentication of public keys within a CA-based PKI system

*** One of those issues is, for example, having to pay to get a digital certificate. With Web of Trust two people choose to trust one another and because of that, are able to give that trust to other people. Another example is the system of rating products sold online. You are trusting the rating system of others to give a consensus if what you’re seeing is trustworthy or not.

41
Q

What is a self-signed certificate?

A

A way to bypassing using a third party to authenticate if something is trustworthy.

*** With these certificates, you’ll notice you will get an error on that web browser that you must elect to trust them and assume the risks associated with that.

42
Q

PGP (Pretty Good Privacy) is an example of Web of Trust. True or False?

A

True

Where every person who trusts you starts helping to increase your rating and then, as more people know you and trust you, other people are going to know you and trust you.

The same thing kind of happens on Twitter and Facebook and other social media. Google uses this same concept when it’s ranking websites.

43
Q

What is transitive trust?

A

When X trusts Y and Y trusts Z therefore X trusts Z.

This is because trust flows from the first part through the second party to the third party.

44
Q

Non-repudiations occurs when…?

A

A sender cannot claim that they didn’t send an email when they did.

45
Q

What is CSR?

A

Certificate Signing Request

This is what is submitted to the CA (certificate authority) to request a digital certificate

Security+ UDemy (33 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions